A USB drop attack is a form of baiting in which an attacker leaves or sends a malicious USB device, such as a flash drive, a disguised keyboard emulator or a tampered cable, hoping someone will plug it into a computer. Put simply, the attacker relies on curiosity or helpfulness to get their hardware past the firewall and onto a trusted machine. The device may carry malware, pretend to be a keyboard and type commands at machine speed, or open a hidden connection back to the attacker. This guide explains the device types in general terms, what research and law enforcement warnings show, why the attack still works, and how to defend against it with device control, HID policy and a clear found-device process. It is written for endpoint, security operations and awareness teams; the detailed removable storage configuration lives in the Removable Media and USB Control Guide and is not repeated here.
Key takeaways
- Three device classes, three different controls. Malicious storage is stopped by storage policy and execution controls, keystroke injection devices by HID policy, and malicious cables mostly by procurement and physical rules.
- People really do plug in found drives. In the 2016 University of Illinois and Google study of 297 dropped drives, the first was connected in under six minutes, and helping the owner was the main motive.
- Blocking USB storage is not enough. Devices that present as keyboards work even where removable storage is disabled, as the FBI's 2022 warning about FIN7's mailed devices made clear.
- Mailed devices are a live threat. USB devices sent in official-looking packages or as gifts should be treated as suspect until IT has inspected them.
- The found-device process is a control. A simple, blame-free rule ("hand it in, never plug it in") plus a safe inspection station turns an attack into a report.
What it is
USB drop attacks are the physical branch of baiting. See the Baiting Attacks Guide for the wider technique and the Social Engineering Guide for the family it belongs to. The lure is the object itself, often made more tempting by a label ("Payroll", "Confidential", "Holiday photos"), a branded case, or packaging that looks like a supplier gift or an official mailing.
| Device class (general terms) | What it does when connected | ATT&CK technique | Primary control |
|---|---|---|---|
| Malicious storage | Carries files that the user opens, or that run through shortcut or autorun tricks | T1091 Replication Through Removable Media; T1204.002 Malicious File | Storage deny or read-only, AutoRun off, execution controls |
| Keystroke injection (HID) device | Registers as a keyboard and types pre-programmed commands faster than a person can react | T1200 Hardware Additions | HID allowlisting, device installation restrictions, locked screens |
| Composite device | Presents several functions at once, for example storage plus keyboard or a network adapter | T1200 Hardware Additions | Device installation restrictions by class and device ID |
| Malicious cable | Looks like an ordinary charging or data cable but contains hidden electronics that can inject keystrokes or provide remote access | T1200 Hardware Additions | Approved cable sourcing, no unknown cables, HID policy |
| Destructive device | Designed to damage the port or machine electrically | Not an intrusion technique | Physical policy, port blockers on exposed kiosks |
Data theft in the other direction (staff copying data to USB) is a different problem, covered by ATT&CK T1052.001 Exfiltration over USB and the Data Loss Prevention (DLP) Guide.
How it works
- Placement: the device is left where targets will find it (car parks, receptions, lifts, conference venues, smoking areas) or posted directly to named staff with a cover letter.
- Attraction: the finder wants to return it, is curious about the label, or believes the mailing is genuine. Mailed packages add pretexting: a gift card, a thank-you note or official guidance.
- Connection: the user plugs it into a work laptop, often while signed in and unlocked, which gives the device the user's privileges.
- Action: storage devices wait for the user to open a file; HID devices start typing immediately, usually to download and run a second-stage payload; cable implants may wait for remote instructions.
- Follow-on: the second stage installs a backdoor or remote access tool, steals credentials, or prepares the network for ransomware.
What the evidence shows
- Dropped drives get used: Tischer, Durumeric, Bailey, Bursztein and colleagues (IEEE Symposium on Security and Privacy, 2016) dropped 297 drives across a large university campus. They estimated a success rate between 45% and 98%, saw the first connection in under six minutes, found that the drive's appearance did not change success, and reported that most people plugged drives in out of altruism. The users were typical members of the community, not unusually careless.
- Mailed HID devices against businesses: in January 2022 BleepingComputer reported an updated FBI flash alert stating that FIN7 had mailed USB devices through USPS and UPS to businesses in transportation and insurance from August 2021 and in the defence industry from November 2021. The packages impersonated Amazon and the US Department of Health and Human Services and came with letters about COVID-19 guidance, gift cards or thank-you notes. Once connected, the devices registered as keyboards, which works even when removable storage is disabled, and injected keystrokes to install malware with the aim of deploying ransomware.
- USB-borne worms persist: the Removable Media and USB Control Guide documents Raspberry Robin, which spread through malicious shortcut files on USB drives, as a recent example of storage-borne malware.
Why it matters
- It skips the perimeter: email gateways, web proxies and firewalls never see the initial delivery. The first security control in the path is the endpoint.
- It runs as the user: a keystroke injection device types with whatever rights the signed-in user has. A local administrator or a privileged engineer's workstation multiplies the impact.
- It reaches isolated networks: air-gapped and OT environments depend on removable media for updates and data transfer, which makes media hygiene a primary control there. See the OT Security Guide.
- Devices are cheap and look ordinary: keystroke injection hardware and implanted cables are commercially available and hard to tell from genuine items by eye.
- It is often missing from tests: many awareness programmes simulate email only, so organisations have no data on how staff treat found or mailed devices.
Defences that work
The Removable Media and USB Control Guide covers storage policy, Defender for Endpoint device control groups and entries, BitLocker To Go, Endpoint DLP, AutoPlay settings and the full rollout. This section focuses on what is specific to drop attacks: the HID gap, mailed devices and the human process.
Close the HID gap
- Know the limitation: storage policies in Defender for Endpoint device control apply to devices that create a drive letter. A device that enumerates only as a keyboard is outside that scope.
- Allowlist input devices on high-risk machines: use the Group Policy or Intune ADMX settings under Computer Configuration > Administrative Templates > System > Device Installation > Device Installation Restrictions. Combine "Prevent installation of devices not described by other policy settings" with "Allow installation of devices that match any of these device IDs" listing your standard keyboards, mice, docks and the USB host controllers and hubs they connect through. Enable "Apply layered order of evaluation" so specific allows override broader prevents.
- Test before enforcing: Microsoft warns that blocking by class without allowing the hub and controller chain can lock out the keyboard and mouse. Test with a remote session or a backup admin route, and avoid "Also apply to matching devices that are already installed" until the allowlist is proven.
- Remove the administrator override: leave "Allow administrators to override Device Installation Restriction policies" disabled, or local admins can bypass the allowlist.
- Choose where to apply it: full HID allowlisting suits privileged access workstations, kiosks, OT engineering stations and shared reception machines. For general laptops it adds support load, so rely on the other layers and detection.
Reduce what an injected session can do
- No local admin: keystrokes typed as a standard user cannot install drivers or services.
- Execution controls: application allowlisting and ASR rules such as "Block untrusted and unsigned processes that run from USB" (b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4) and "Block execution of potentially obfuscated scripts" (5beb7efe-fd9a-4556-801d-275e5ffc04cc) break common second stages. See the Application Allowlisting Guide.
- PowerShell hardening and EDR: constrained language mode where practical, script block logging, and EDR in block mode to stop the download-and-run step. See the EDR Guide.
- Screen locks: short inactivity locks and a habit of locking unattended machines reduce opportunities for someone to plug a device into an unlocked session.
- AutoRun off: set "Turn off Autoplay" for all drives and "Set the default behavior for AutoRun" to not execute autorun commands, so storage cannot launch content on insertion.
The human process
- One rule: found or unexpected USB devices, cables and chargers are never plugged in; they go to IT or security.
- Mailed items: mailroom and reception staff route unsolicited packages containing USB devices to security unopened where possible, and record sender details.
- Safe inspection: IT examines devices on an isolated, non-domain analysis machine with no credentials and no network, or simply destroys them. Never use a production workstation to "see whose it is".
- Report without blame: anyone who has already plugged a device in reports it immediately; the endpoint is isolated and checked. Speed matters more than fault.
- Supply your own: provide approved, encrypted drives and cables so staff have no reason to use unknown ones.
Small versus large organisations
A small organisation should apply no local admin, AutoRun off, the USB ASR rule and the hand-in rule, and test one authorised drop exercise a year. A large organisation adds HID allowlisting on privileged and exposed machines, a mailroom procedure, a dedicated inspection station, device inventory by serial number and SIEM collection of device events across all endpoints. Authorised drop tests should be run under the rules in the Social Engineering and Physical Penetration Testing Guide, with harmless beacon files rather than live code.
Detection and measurement
| Signal | Source | Why it matters |
|---|---|---|
| Event ID 6416 (a new external device was recognised) | Windows Security log, Audit PNP Activity enabled | Records every new device, including keyboards, with its hardware IDs |
| PnPDeviceBlocked and PnPDeviceAllowed | Defender for Endpoint advanced hunting, DeviceEvents | Shows device installation restriction decisions |
| RemovableStoragePolicyTriggered | Defender for Endpoint advanced hunting, DeviceEvents | Storage policy audit or enforcement hits |
| AsrUntrustedUsbProcessBlocked | Defender for Endpoint advanced hunting | Attempt to run an untrusted program from USB |
| A second keyboard appearing, followed within seconds by a shell launching and a download | EDR process and device telemetry correlated | Classic keystroke injection pattern |
Metrics that show the programme is working:
- Drop test plug-in rate: percentage of test devices connected; should fall year on year.
- Drop test report rate: percentage of found test devices handed in or reported; should rise.
- HID allowlist coverage: percentage of privileged, kiosk and OT machines with input device allowlisting enforced.
- Unknown HID events: new keyboard-class devices on allowlisted machines per month, each investigated.
- Time to isolate: minutes from a "I plugged it in" report to the endpoint being contained.
Common misconceptions
- "We block USB storage, so we are covered." Keystroke injection devices present as keyboards and are not stopped by storage policy, which is exactly how the FIN7 mailings were designed.
- "Only careless people plug in found drives." The 2016 study found typical community members did it, mostly to help return the drive.
- "Checking the drive on an old spare PC is safe." A spare machine on the corporate network, or one signed in with corporate credentials, is still a foothold. Use an isolated analysis system or destroy the device.
- "Cables are just cables." Implanted cables look identical to normal ones. Unknown cables and chargers deserve the same rule as unknown drives.
- "Professional-looking packaging means it is genuine." Attackers impersonate retailers and government departments. Unsolicited hardware should be verified with the claimed sender through a known contact route.
Related concepts
| Concept | Relationship | Where to read more |
|---|---|---|
| Baiting | The parent social engineering technique | Baiting Attacks Guide |
| Removable media control | Configuration of storage, encryption and device control | Removable Media and USB Control Guide |
| Juice jacking | Malicious charging points and cables | Juice Jacking Guide |
| Keyloggers | Hardware and software that capture keystrokes, the reverse of injection | Keyloggers Guide |
| Computer worms | Self-spreading malware that uses removable media | Computer Worms Guide |
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1200, T1091, T1204.002 | Hardware additions, removable media replication, malicious file execution |
| MITRE ATT&CK mitigations | M1034 Limit Hardware Installation, M1042 Disable or Remove Feature or Program, M1017 User Training | Device restrictions, AutoRun removal, awareness |
| NIST SP 800-53 Rev. 5 | MP-7, SC-41, PE-3, AT-2(3), SI-3 | Media use, port and I/O device access, physical access, social engineering awareness, malicious code |
| NIST CSF 2.0 | PR.AT-01, PR.PS-05, DE.CM-09 | Training, preventing unauthorised execution, endpoint monitoring |
| CIS Controls v8.1 | 10.3, 14.2 | Disable autorun and autoplay for removable media, social engineering training |
| ISO/IEC 27001:2022 Annex A | A.7.10, A.8.7, A.6.3 | Storage media, protection against malware, awareness |
Practitioner checklist
- Apply the storage, AutoRun and device control baseline from the Removable Media and USB Control Guide.
- Decide explicitly which machine groups get HID allowlisting and enforce it on privileged, kiosk and OT systems first.
- Keep the device installation administrator override disabled.
- Deploy the USB and obfuscated script ASR rules and remove local admin from daily accounts.
- Publish the "hand it in, never plug it in" rule for drives, cables and chargers, including mailed items.
- Set up an isolated inspection station or a destroy-on-receipt policy for found devices.
- Collect Event ID 6416 and device control events centrally and alert on new keyboards on allowlisted machines.
- Issue approved encrypted drives and cables so staff have a safe alternative.
- Run an authorised drop test annually and track plug-in and report rates.
Standards and references
- MITRE ATT&CK: Hardware Additions (T1200)
- MITRE ATT&CK: Replication Through Removable Media (T1091)
- NIST: SP 800-53 Rev. 5
- Microsoft Learn: Device control in Microsoft Defender for Endpoint
- Microsoft Learn: Manage device installation with Group Policy
- Microsoft Learn: Policy CSP AutoPlay
- Google Research: Users Really Do Plug in USB Drives They Find
- BleepingComputer: FBI: Hackers use BadUSB to target defense firms with ransomware
Related NHI Mgmt Group resources: Removable Media and USB Control Guide · Baiting Attacks Guide · Juice Jacking Guide · Social Engineering Guide